Rate Limiting | Bootspring Docs

Patterns for implementing API rate limiting to protect against abuse.

Overview#

Rate limiting prevents abuse and ensures fair usage of your API. This pattern covers:

In-memory rate limiting
Redis-based distributed limiting
Sliding window algorithm
Token bucket algorithm
Per-user and per-endpoint limits

Prerequisites#

npm install @upstash/redis

Code Example#

In-Memory Rate Limiter#

// lib/rate-limit.ts
const rateLimitMap = new Map<string, { count: number; resetTime: number }>()

export function rateLimit(
  key: string,
  limit: number,
  windowMs: number
): { success: boolean; remaining: number; resetIn: number } {
  const now = Date.now()
  const record = rateLimitMap.get(key)

  if (!record || now > record.resetTime) {
    rateLimitMap.set(key, { count: 1, resetTime: now + windowMs })
    return { success: true, remaining: limit - 1, resetIn: windowMs }
  }

  if (record.count >= limit) {
    return {
      success: false,
      remaining: 0,
      resetIn: record.resetTime - now
    }
  }

  record.count++
  return {
    success: true,
    remaining: limit - record.count,
    resetIn: record.resetTime - now
  }
}

Redis Rate Limiter#

// lib/rate-limit-redis.ts
import { Redis } from '@upstash/redis'

const redis = new Redis({
  url: process.env.UPSTASH_REDIS_URL!,
  token: process.env.UPSTASH_REDIS_TOKEN!
})

export async function rateLimitRedis(
  key: string,
  limit: number,
  windowSeconds: number
) {
  const current = await redis.incr(key)

  if (current === 1) {
    await redis.expire(key, windowSeconds)
  }

  const ttl = await redis.ttl(key)

  return {
    success: current <= limit,
    remaining: Math.max(0, limit - current),
    resetIn: ttl > 0 ? ttl * 1000 : windowSeconds * 1000
  }
}

Sliding Window Rate Limiter#

// lib/rate-limit-sliding.ts
import { Redis } from '@upstash/redis'

const redis = new Redis({
  url: process.env.UPSTASH_REDIS_URL!,
  token: process.env.UPSTASH_REDIS_TOKEN!
})

export async function slidingWindowRateLimit(
  key: string,
  limit: number,
  windowMs: number
) {
  const now = Date.now()
  const windowStart = now - windowMs

  // Remove old entries and add new one
  const pipeline = redis.pipeline()
  pipeline.zremrangebyscore(key, 0, windowStart)
  pipeline.zadd(key, { score: now, member: `${now}-${Math.random()}` })
  pipeline.zcard(key)
  pipeline.expire(key, Math.ceil(windowMs / 1000))

  const results = await pipeline.exec()
  const count = results[2] as number

  return {
    success: count <= limit,
    remaining: Math.max(0, limit - count),
    resetIn: windowMs
  }
}

Rate Limit Middleware#

// middleware.ts
import { NextResponse } from 'next/server'
import type { NextRequest } from 'next/server'
import { rateLimitRedis } from '@/lib/rate-limit-redis'

const RATE_LIMITS = {
  '/api/': { limit: 100, window: 60 },           // 100 req/min
  '/api/auth/': { limit: 10, window: 60 },       // 10 req/min
  '/api/ai/': { limit: 20, window: 60 }          // 20 req/min
}

export async function middleware(request: NextRequest) {
  const ip = request.ip ?? request.headers.get('x-forwarded-for') ?? 'unknown'
  const path = request.nextUrl.pathname

  // Find matching rate limit
  let config = { limit: 100, window: 60 }
  for (const [prefix, limits] of Object.entries(RATE_LIMITS)) {
    if (path.startsWith(prefix)) {
      config = limits
      break
    }
  }

  const key = `rate-limit:${ip}:${path}`
  const result = await rateLimitRedis(key, config.limit, config.window)

  if (!result.success) {
    return NextResponse.json(
      { error: 'Too many requests' },
      {
        status: 429,
        headers: {
          'X-RateLimit-Limit': config.limit.toString(),
          'X-RateLimit-Remaining': '0',
          'X-RateLimit-Reset': Math.ceil(
            Date.now() / 1000 + result.resetIn / 1000
          ).toString(),
          'Retry-After': Math.ceil(result.resetIn / 1000).toString()
        }
      }
    )
  }

  const response = NextResponse.next()
  response.headers.set('X-RateLimit-Limit', config.limit.toString())
  response.headers.set('X-RateLimit-Remaining', result.remaining.toString())

  return response
}

export const config = {
  matcher: '/api/:path*'
}

Per-User Rate Limiting#

// lib/rate-limit-user.ts
import { auth } from '@/auth'
import { rateLimitRedis } from './rate-limit-redis'

export async function userRateLimit(baseLimit: number) {
  const session = await auth()
  const userId = session?.user?.id

  // Higher limits for authenticated users
  const limit = userId ? baseLimit * 2 : baseLimit

  // Use user ID or IP as key
  const key = userId ?? (await getClientIP())

  return rateLimitRedis(`user:${key}`, limit, 60)
}

// Tiered limits based on plan
export async function tieredRateLimit(endpoint: string) {
  const session = await auth()
  const plan = session?.user?.plan ?? 'free'

  const limits: Record<string, number> = {
    free: 100,
    pro: 1000,
    enterprise: 10000
  }

  const limit = limits[plan] ?? limits.free
  const key = `tier:${session?.user?.id ?? 'anon'}:${endpoint}`

  return rateLimitRedis(key, limit, 3600) // Per hour
}

Token Bucket Algorithm#

// lib/token-bucket.ts
interface Bucket {
  tokens: number
  lastRefill: number
}

const buckets = new Map<string, Bucket>()

export function tokenBucket(
  key: string,
  maxTokens: number,
  refillRate: number // tokens per second
): boolean {
  const now = Date.now()
  let bucket = buckets.get(key)

  if (!bucket) {
    bucket = { tokens: maxTokens, lastRefill: now }
    buckets.set(key, bucket)
  }

  // Refill tokens based on time passed
  const timePassed = (now - bucket.lastRefill) / 1000
  bucket.tokens = Math.min(maxTokens, bucket.tokens + timePassed * refillRate)
  bucket.lastRefill = now

  // Try to consume a token
  if (bucket.tokens >= 1) {
    bucket.tokens -= 1
    return true
  }

  return false
}

// Usage: Allow bursts but limit sustained rate
const allowed = tokenBucket('user:123', 10, 1) // 10 burst, 1/sec sustained

API Route with Rate Limiting#

// app/api/protected/route.ts
import { NextRequest, NextResponse } from 'next/server'
import { rateLimitRedis } from '@/lib/rate-limit-redis'

export async function POST(request: NextRequest) {
  const ip = request.ip ?? 'unknown'

  const { success, remaining, resetIn } = await rateLimitRedis(
    `api:protected:${ip}`,
    10, // 10 requests
    60  // per minute
  )

  if (!success) {
    return NextResponse.json(
      { error: 'Rate limit exceeded. Please try again later.' },
      {
        status: 429,
        headers: {
          'Retry-After': Math.ceil(resetIn / 1000).toString()
        }
      }
    )
  }

  // Process request...
  const data = await request.json()

  return NextResponse.json(
    { success: true },
    {
      headers: {
        'X-RateLimit-Remaining': remaining.toString()
      }
    }
  )
}

Usage Instructions#

Choose the appropriate algorithm for your use case
Use Redis for distributed rate limiting across multiple instances
Set different limits for different endpoints and user tiers
Include rate limit headers in responses
Return 429 status with Retry-After header when limited

Best Practices#

Use Redis in production - In-memory only works for single instances
Different limits per endpoint - Auth endpoints need stricter limits
Higher limits for authenticated users - Reward logged-in users
Include rate limit headers - Help clients manage their requests
Log rate limit hits - Monitor for abuse patterns
Graceful degradation - If Redis fails, allow requests through
Consider sliding windows - More accurate than fixed windows

Security Headers - HTTP security headers
API Middleware - Request middleware
Monitoring - Track rate limit metrics
Caching - Reduce load on endpoints